spamtrap 0.3.1 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 619741f1ea048808a9235e1bc02a814c2d6606aed599e188c3ea99d464e2fc85
-  data.tar.gz: e309645da54a5ac5c898b83f8e90b5132361001724469ceabe18bf7f3195fbac
+  metadata.gz: d3ff3c236a80418a4048beacd5cb3ff88c555a45d4736a8ea743a97a924d1283
+  data.tar.gz: 882c96f34aa70bfe8fab481704d96b97b8a9424c1d5b637140d7d60cb56abb30
 SHA512:
-  metadata.gz: 9e8328c22c89ee565ef34c2cff0e2ecad4aae2b9e71a9627bb6162e57e1013577fa53f65a56a217928e8d0503017b4c2508cec435ecf0c911eb257da53087f59
-  data.tar.gz: 49fa2e0f20b2489eb082c9bd4cd3fe1a09f4d4ddd03022676e12a91fc7779a0bab36e1a628205a0a1f29904da8292a984ef11a317bda486eed0c74f1a5d42909
+  metadata.gz: 2316d8928764a5071ff756e37717f3d52924f85f8e7fb34a6de9109bec0d103716e2cfe428456557d9664e0c117fb2c9c8b735d231c16440610ec391d77afb00
+  data.tar.gz: db528095a79dc96011fad7ee831f7164650c3d3cfb92004ea6edced38fec1aa39df5ce87d4cef793631c713ccc668dd040f61b9e56d70c6b8b174338732ed9ec

data/lib/spamtrap/controller.rb

@@ -9,9 +9,10 @@ module Spamtrap::Controller
     def spamtrap(honeypot = 'spamtrap', options = {}, &block)
       # Capture explicit per-call values; use sentinel so globals are read
       # at request time rather than at class definition time.
-      nonce_opt   = options.key?(:nonce)         ? options.delete(:nonce)         : :global
-      timeout_opt = options.key?(:nonce_timeout) ? options.delete(:nonce_timeout) : :global
-      mutate_opt  = options.key?(:mutate)        ? options.delete(:mutate)        : :global
+      nonce_opt    = options.key?(:nonce)         ? options.delete(:nonce)         : :global
+      timeout_opt  = options.key?(:nonce_timeout) ? options.delete(:nonce_timeout) : :global
+      mutate_opt   = options.key?(:mutate)        ? options.delete(:mutate)        : :global
+      on_trap_opt  = options.key?(:on_trap)       ? options.delete(:on_trap)       : :global
 
       before_action(options) do |controller|
         controller.instance_eval(&block) if block_given?
@@ -24,9 +25,11 @@ module Spamtrap::Controller
 
           if params[honeypot].present?
             Rails.logger.warn "Spamtrap triggered by #{request.remote_ip}."
+            spamtrap_invoke_on_trap(:honeypot, on_trap_opt)
             head 200
           elsif nonce_enabled && !spamtrap_valid_nonce?(nonce_timeout)
             Rails.logger.warn "Spamtrap nonce invalid from #{request.remote_ip}."
+            spamtrap_invoke_on_trap(:nonce, on_trap_opt)
             head 200
           end
         end
@@ -69,7 +72,15 @@ module Spamtrap::Controller
     end
   end
 
-  private :spamtrap_valid_nonce?, :spamtrap_remap_params, :spamtrap_remap_hash
+  def spamtrap_invoke_on_trap(reason, on_trap_opt)
+    callback = on_trap_opt == :global ? Spamtrap.on_trap : on_trap_opt
+    return unless callback.respond_to?(:call)
+    callback.call(reason: reason, request: request)
+  rescue StandardError => e
+    Rails.logger.error "Spamtrap on_trap callback raised: #{e.class}: #{e.message}"
+  end
+
+  private :spamtrap_valid_nonce?, :spamtrap_remap_params, :spamtrap_remap_hash, :spamtrap_invoke_on_trap
 
 end
 

data/lib/spamtrap/helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Spamtrap
   module FormBuilderMutation
     include Spamtrap::Crypto
@@ -11,8 +13,45 @@ module Spamtrap
 
     MUTABLE_FIELDS.each do |m|
       define_method(m) do |field, *args, &blk|
-        field = spamtrap_encrypt_field(field.to_s, @spamtrap_salt) if @spamtrap_salt
-        super(field, *args, &blk)
+        if @spamtrap_salt
+          encrypted_field = spamtrap_encrypt_field(field.to_s, @spamtrap_salt)
+
+          opts =
+            if m == :check_box
+              args.first.is_a?(Hash) ? args.shift.dup : {}
+            else
+              args.last.is_a?(Hash) ? args.pop.dup : {}
+            end
+
+          model_value = object.respond_to?(field) ? object.public_send(field) : nil
+
+          case m
+          when :check_box
+            # :checked controls the checked state; :value is the submitted value ("1" by default)
+            opts[:checked] = !!model_value unless opts.key?(:checked)
+            super(encrypted_field, opts, *args, &blk)
+          when :select, :collection_select, :grouped_collection_select
+            # :selected belongs in the inner options hash, not html_options (the last hash).
+            # After popping html_options into opts, args.last is the options hash (if present).
+            if args.last.is_a?(Hash)
+              sel_opts = args.pop.dup
+              sel_opts[:selected] = model_value unless sel_opts.key?(:selected)
+              args.push(sel_opts)
+            else
+              opts[:selected] = model_value unless opts.key?(:selected)
+            end
+
+            super(encrypted_field, *args, opts, &blk)
+          when :label
+            # label renders a <label> element and does not read a value from the model object
+            super(encrypted_field, *args, opts, &blk)
+          else
+            opts[:value] = model_value unless opts.key?(:value)
+            super(encrypted_field, *args, opts, &blk)
+          end
+        else
+          super(field, *args, &blk)
+        end
       end
     end
 

data/lib/spamtrap/version.rb

@@ -1,5 +1,5 @@
 module Spamtrap
 
-  VERSION = '0.3.1'
+  VERSION = '0.3.3'
 
 end

data/lib/spamtrap.rb

@@ -2,7 +2,8 @@ require 'openssl'
 
 module Spamtrap
   class << self
-    attr_writer :nonce, :nonce_timeout, :mutate
+    attr_accessor :on_trap
+    attr_writer   :nonce, :nonce_timeout, :mutate
 
     def nonce
       @nonce || false

data/test/controller_test.rb

@@ -345,3 +345,129 @@ class GlobalOverrideControllerTest < ActionController::TestCase
     assert_equal 'body', response.body
   end
 end
+
+# Controllers for on_trap callback tests.
+class OnTrapGlobalCallbackController < ActionController::Base
+  spamtrap :trap_field, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapGlobalNonceCallbackController < ActionController::Base
+  spamtrap :trap_field, nonce: true, only: :create
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapPerDeclarationController < ActionController::Base
+  spamtrap :trap_field, only: :create,
+    on_trap: ->(reason:, request:) { Thread.current[:per_decl_calls] << { reason: reason, ip: request.remote_ip } }
+
+  def create
+    render plain: 'success'
+  end
+end
+
+class OnTrapCallbackTest < ActionController::TestCase
+  tests OnTrapGlobalCallbackController
+
+  setup do
+    @calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @calls << { reason: reason, ip: request.remote_ip } }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_global_callback_invoked_on_honeypot_trap
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, @calls.size
+    assert_equal :honeypot, @calls.first[:reason]
+  end
+
+  def test_global_callback_not_invoked_on_legitimate_request
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_equal 'success', response.body
+    assert_empty @calls
+  end
+
+  def test_no_callback_when_on_trap_is_nil
+    Spamtrap.on_trap = nil
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    # no error raised — test simply passes
+  end
+end
+
+class OnTrapNonceCallbackTest < ActionController::TestCase
+  include NonceTestHelper
+  tests OnTrapGlobalNonceCallbackController
+
+  setup do
+    @calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @calls << { reason: reason, ip: request.remote_ip } }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_global_callback_invoked_on_nonce_trap
+    post :create, params: { trap_field: '' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, @calls.size
+    assert_equal :nonce, @calls.first[:reason]
+  end
+end
+
+class OnTrapPerDeclarationCallbackTest < ActionController::TestCase
+  tests OnTrapPerDeclarationController
+
+  setup do
+    Thread.current[:per_decl_calls] = []
+    @global_calls = []
+    Spamtrap.on_trap = ->(reason:, request:) { @global_calls << reason }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+    Thread.current[:per_decl_calls] = nil
+  end
+
+  def test_per_declaration_callback_takes_precedence_over_global
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+    assert_equal 1, Thread.current[:per_decl_calls].size
+    assert_equal :honeypot, Thread.current[:per_decl_calls].first[:reason]
+    assert_empty @global_calls
+  end
+end
+
+class OnTrapCallbackErrorResilienceTest < ActionController::TestCase
+  tests OnTrapGlobalCallbackController
+
+  setup do
+    Spamtrap.on_trap = ->(**) { raise 'callback exploded' }
+  end
+
+  teardown do
+    Spamtrap.on_trap = nil
+  end
+
+  def test_broken_callback_does_not_prevent_head_200
+    post :create, params: { trap_field: 'spam' }
+    assert_response :ok
+    assert_empty response.body
+  end
+end

data/test/form_builder_mutation_test.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require File.join(File.dirname(__FILE__), 'test_helper')
+require 'action_view'
+require 'action_view/test_case'
+
+# A simple model-like struct to back the form builder, mimicking an AR model.
+Message = Struct.new(:name, :email, :body, :active, :country)
+
+class FormBuilderMutationTest < ActionView::TestCase
+  include Spamtrap::Crypto
+
+  # Build a minimal form builder instance backed by a Message object.
+  def build_form_builder(object)
+    ActionView::Helpers::FormBuilder.new(:message, object, self, {})
+  end
+
+  # --- text-like inputs ---
+
+  def test_text_field_does_not_raise_when_mutate_is_true
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_nothing_raised { f.text_field(:name) }
+    assert_nothing_raised { f.email_field(:email) }
+    assert_nothing_raised { f.text_area(:body) }
+  end
+
+  def test_model_value_is_preserved_in_encrypted_field
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_includes f.text_field(:name), 'Alice'
+    assert_includes f.email_field(:email), 'alice@example.com'
+    assert_includes f.text_area(:body), 'Hello'
+  end
+
+  def test_encrypted_field_name_is_used_in_html
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    html = f.text_field(:name)
+
+    # The original unencrypted name must NOT appear as the input name attribute
+    refute_match(/name="message\[name\]"/, html)
+  end
+
+  def test_nil_model_value_does_not_raise
+    msg = Message.new(nil, nil, nil)
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_nothing_raised { f.text_field(:name) }
+  end
+
+  def test_virtual_field_without_model_method_does_not_raise
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    # :nonexistent is not a method on Message; should render with empty value, not crash
+    assert_nothing_raised { f.text_field(:nonexistent) }
+  end
+
+  def test_explicit_value_option_is_preserved
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    html = f.text_field(:name, value: 'Overridden')
+
+    assert_includes html, 'Overridden'
+    refute_includes html, 'Alice'
+  end
+
+  # --- no mutation ---
+
+  def test_no_salt_leaves_field_names_unencrypted
+    msg = Message.new('Alice', 'alice@example.com', 'Hello')
+    f   = build_form_builder(msg)
+
+    html = f.text_field(:name)
+
+    assert_match(/name="message\[name\]"/, html)
+  end
+
+  # --- check_box ---
+
+  def test_check_box_does_not_raise_when_mutate_is_true
+    msg = Message.new(nil, nil, nil, true)
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_nothing_raised { f.check_box(:active) }
+  end
+
+  def test_check_box_checked_when_model_value_is_true
+    msg = Message.new(nil, nil, nil, true)
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_includes f.check_box(:active), 'checked'
+  end
+
+  def test_check_box_unchecked_when_model_value_is_false
+    msg = Message.new(nil, nil, nil, false)
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    refute_includes f.check_box(:active), 'checked'
+  end
+
+  # --- select ---
+
+  def test_select_does_not_raise_when_mutate_is_true
+    msg = Message.new(nil, nil, nil, nil, 'US')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    assert_nothing_raised { f.select(:country, %w[US CA GB]) }
+  end
+
+  def test_select_preselects_model_value
+    msg = Message.new(nil, nil, nil, nil, 'CA')
+    f   = build_form_builder(msg)
+    f.spamtrap(:trap, mutate: true)
+
+    html = f.select(:country, %w[US CA GB])
+
+    assert_match(/selected.*CA|CA.*selected/, html)
+  end
+
+  private
+
+  # ActionView::TestCase helpers expect a #request method; provide a stub.
+  def request
+    @request ||= ActionDispatch::TestRequest.create
+  end
+end

data/test/test_helper.rb

@@ -21,6 +21,9 @@ Rails.application.routes.draw do
   post 'nested_mutation/create',  to: 'nested_mutation#create'
   post 'global_defaults/create',  to: 'global_defaults#create'
   post 'global_override/create',  to: 'global_override#create'
+  post 'on_trap_global_callback/create',       to: 'on_trap_global_callback#create'
+  post 'on_trap_global_nonce_callback/create', to: 'on_trap_global_nonce_callback#create'
+  post 'on_trap_per_declaration/create',       to: 'on_trap_per_declaration#create'
 end
 
 class ActionController::TestCase

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spamtrap
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.3
 platform: ruby
 authors:
 - Cedric Howe
@@ -36,6 +36,7 @@ files:
 - lib/spamtrap/helper.rb
 - lib/spamtrap/version.rb
 - test/controller_test.rb
+- test/form_builder_mutation_test.rb
 - test/test_helper.rb
 homepage: http://github.com/cedric/spamtrap/
 licenses:
@@ -60,4 +61,5 @@ specification_version: 4
 summary: Simple spamtrap for spambots.
 test_files:
 - test/controller_test.rb
+- test/form_builder_mutation_test.rb
 - test/test_helper.rb